TI-2026-39184 CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Priority HIGH 77
sqlparse is a non-validating SQL parser module for Python.
RHSA-2026:66371
OpenShift Container Platform 4.19.47 bug fix and security update
Released 2026-09-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9 +8
Fixes 6 records
TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Priority HIGH 77
linkify-it is a links recognition library with full Unicode support.
TI-2026-32848 CVE-2026-44990 · GHSA-rpr9-rxv7-x643
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.